AI Sec Watch

A security flaw in Coder's AI Bridge (a proxy for accessing LLM services) allowed suspended users to keep using their existing API keys (authentication tokens) because the system didn't check if an account was suspended, only if the key itself was valid. This meant a suspended user could continue making expensive AI requests until their token expired, which could be months later.

Coder's AI Bridge provider endpoints had a vulnerability where they read incoming request bodies without limiting their size, allowing an authenticated user to send extremely large requests that consume all available memory and crash the system (denial of service, a type of attack that makes a service unavailable). This vulnerability only affects versions 2.33 and 2.34 and requires the attacker to already have authenticated access to the AI Bridge feature.

The `coder open app` command (a tool that opens external applications linked to workspaces) was vulnerable to leaking session tokens (secret credentials that prove a user's identity) to attacker-controlled websites. When a workspace's external app URL contained a `$SESSION_TOKEN` placeholder, the command would replace it with the real token before opening the URL, potentially sending it to an attacker's server if they controlled the workspace's app definitions. This could allow an attacker to impersonate the user and access their account.

A vulnerability in Coder's file upload feature allows an authenticated user to crash the service by uploading a specially crafted zip file containing many highly compressed entries that consume excessive memory during decompression. The zip file stays under the 100 MiB upload limit, but when decompressed in memory, it exhausts available memory and causes a denial of service (making the service unavailable), though it cannot leak data or execute code.

Coder's workspace app routing trusts an unauthenticated HTTP header called X-Forwarded-Host (a header that tells the server what hostname the request came for) without verifying it came from a trusted source. An attacker can set this header in their browser to trick the server into routing requests to a victim's private app while still using the victim's authentication cookies (session identifiers), allowing the attacker to read data from that private app. This only works if subdomain app routing (using wildcard hostnames to serve multiple apps) is enabled and the upstream proxy doesn't remove this header.

Coder's tailnet coordinator (the server managing a private network) didn't validate that `AllowedIPs` (IP address ranges an agent claims to serve) matched the agent's identity, even though it did validate the agent's regular addresses. This let a malicious authenticated agent claim another agent's IP address and intercept traffic meant for that agent, such as web terminal sessions. Exploiting this required an authenticated user with a modified agent binary.

A vulnerability in Coder's workspace app system allows attackers with template authorship or external provisioner access to redirect another user's app traffic to their own workspace. The flaw occurs because the system doesn't properly verify that an app ID belongs to the correct workspace before rebinding it to a different agent (the component that handles connections). App IDs are publicly discoverable, making this attack feasible for privileged users.

A bug in Coder's file upload system allowed authenticated users to cause a denial of service (making a service unavailable) by sending a message with an extremely large declared file size, which the system would try to allocate into memory without checking if it was reasonable. An attacker could crash the entire Coder deployment with a single small message.

Coder's `coder config-ssh` command didn't properly check server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) before writing them to the user's SSH configuration file, allowing a malicious or compromised server to inject arbitrary SSH configuration directives. An attacker controlling the server could inject commands like ProxyCommand to execute arbitrary code on a developer's workstation with that user's privileges.